contrast-agent 3.13.2 → 4.1.0

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/at_exit_hook'
+require 'contrast/agent/at_exit_hook'
 
 module Contrast
   module Extension
@@ -27,7 +27,7 @@ module Contrast
               source,
               Kernel,
               nil,
-              source)
+              [source])
           # Exec replaces the current process, if we occur in a forked process
           # our appendage of this finding will not make it to TS
           Contrast::Agent::AtExitHook.on_exit

data/lib/contrast/extension/assess/fiber.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 # In order to instrument some difficult methods like String#gsub, as it
 # returns an enumerator, we need to instrument methods on Fiber.
@@ -54,7 +54,6 @@ module Contrast
         class << self
           def track_rb_fiber_yield fiber, _method, results
             return unless ASSESS.enabled?
-            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
 
             # results will be nil if StopIteration was raised,
             # otherwise an Array of the yielded arguments
@@ -62,11 +61,11 @@ module Contrast
 
             with_contrast_scope do
               results.each do |result|
-                next unless Contrast::Utils::DuckUtils.trackable?(result)
-                next if result.cs__frozen?
+                result_properties = Contrast::Agent::Assess::Tracker.properties(result)
+                next unless result_properties
 
-                fiber.cs__splat_tags(result)
-                result.cs__properties.build_event(
+                result_properties.splat_from(fiber, result)
+                result_properties.build_event(
                     FIBER_YIELD_NODE,
                     result,
                     fiber,
@@ -80,13 +79,14 @@ module Contrast
 
           def track_rb_fiber_new fiber, _enum, _enum_method, underlying, _underlying_method
             return unless ASSESS.enabled?
-            return unless Contrast::Utils::DuckUtils.trackable?(fiber)
-            return unless Contrast::Utils::DuckUtils.trackable?(underlying)
             return unless underlying.is_a?(String) && !underlying.empty?
 
             with_contrast_scope do
-              underlying.cs__splat_tags(fiber)
-              fiber.cs__properties.build_event(
+              properties = Contrast::Agent::Assess::Tracker.properties(fiber)
+              return unless properties
+
+              properties.splat_from(underlying, fiber)
+              properties.build_event(
                   FIBER_NEW_NODE,
                   fiber,
                   underlying,
@@ -99,9 +99,9 @@ module Contrast
 
           def instrument_fiber_track
             @_instrument_fiber_variables ||= begin
-                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
-                true
-              end
+              require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading fiber track patch', e)
             false

data/lib/contrast/extension/assess/hash.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -15,9 +15,10 @@ module Contrast
         class << self
           def cs__duplicate_and_freeze object
             return object unless object.is_a?(String) && !object.cs__frozen?
-            return object unless object.cs__tracked?
+            return object unless Contrast::Agent::Assess::Tracker.tracked?(object)
 
-            object.dup.cs__freeze
+            ret = Contrast::Agent::Assess::Tracker.duplicate(object)
+            ret.cs__freeze
           rescue StandardError
             # we'll rescue this error, but we can't log it here as that will
             # result in a seg fault
@@ -25,9 +26,9 @@ module Contrast
 
           def instrument_hash_track
             @_instrument_hash_track ||= begin
-                                            cs__scoped_require 'cs__assess_hash/cs__assess_hash'
-                                            true
-                                          end
+              require 'cs__assess_hash/cs__assess_hash'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false

data/lib/contrast/extension/assess/kernel.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/exec_trigger'
+require 'contrast/components/interface'
+require 'contrast/extension/assess/exec_trigger'
 
 module Contrast
   module Extension
@@ -39,43 +39,47 @@ module Contrast
           # oh, and there's also %<name>type and %{name}... b/c of course there is
           # -HM
           def sprintf_tagger patcher, preshift, ret, _block
+            properties = Contrast::Agent::Assess::Tracker.properties(ret)
+            return unless properties
+
             format_string = preshift.args[0]
             args = preshift.args[1]
 
-            track_sprintf(ret, format_string, args)
+            parent_events = []
+            track_sprintf(ret, format_string, args, parent_events)
 
-            ret.cs__properties.build_event(
+            properties.build_event(
                 patcher,
                 ret,
                 preshift.object,
                 ret,
                 preshift.args,
                 1)
+
+            properties.event.instance_variable_set(:@_parent_events, parent_events)
             ret
           end
 
-          def track_sprintf result, format_string, args
-            handle_sprintf_value(format_string, result)
-            if args.is_a?(String)
-              handle_sprintf_value(args, result)
-            elsif args.is_a?(Hash)
-              handle_sprintf_hash(args, result)
-            elsif args.is_a?(Array)
-              handle_sprintf_array args, result
+          def track_sprintf result, format_string, args, parent_events
+            handle_sprintf_value(format_string, result, parent_events)
+            case args
+            when String
+              handle_sprintf_value(args, result, parent_events)
+            when Hash
+              handle_sprintf_hash(args, result, parent_events)
+            when Array
+              handle_sprintf_array(args, result, parent_events)
             end
-
-            result
           rescue StandardError => e
             logger.error(
                 'Unable to track dataflow through sprintf', e)
-            result
           end
 
           def instrument_kernel_track
             @_instrument_fiber_variables ||= begin
-                                               cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'
-                                               true
-                                             end
+              require 'cs__assess_kernel/cs__assess_kernel'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading kernel track patch', e)
             false
@@ -83,24 +87,26 @@ module Contrast
 
           private
 
-          def handle_sprintf_value value, result
-            return unless Contrast::Utils::DuckUtils.trackable?(value) && value.cs__tracked?
+          def handle_sprintf_value value, result, parent_events
+            properties = Contrast::Agent::Assess::Tracker.properties(result)
+            return unless properties
 
-            value.cs__properties.events.each do |event|
-              result.cs__properties.events << event
-            end
-            value.cs__splat_tags(result)
+            value_properties = Contrast::Agent::Assess::Tracker.properties(value)
+            return unless value_properties
+
+            parent_events << value_properties.event if value_properties.event
+            properties.splat_from(value, result)
           end
 
-          def handle_sprintf_array args, result
+          def handle_sprintf_array args, result, parent_events
             args.each do |value|
-              handle_sprintf_value(value, result)
+              handle_sprintf_value(value, result, parent_events)
             end
           end
 
-          def handle_sprintf_hash args, result
+          def handle_sprintf_hash args, result, parent_events
             args.each_value do |value|
-              handle_sprintf_value(value, result)
+              handle_sprintf_value(value, result, parent_events)
             end
           end
         end

data/lib/contrast/extension/assess/marshal.rb

@@ -0,0 +1,67 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Array class required to handle propagation
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      # This module is used for our Marshal#load patches
+      class MarshalPropagator
+        include Contrast::Components::Interface
+
+        access_component :logging
+
+        class << self
+          def cs__load_trigger_check source, ret
+            current_context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless current_context
+
+            # Since we know this is the source of the trigger, we can do some
+            # optimization here and return when it is not tracked
+            return unless Contrast::Agent::Assess::Tracker.tracked?(source)
+
+            args = [source]
+            # source might not be all the args passed in, but it is the one we care
+            # about. we could pass in all the args in the last param here if it
+            # becomes an issue in rendering on TS
+            Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
+                current_context,
+                trigger_node('Marshal', :load),
+                source,
+                self,
+                ret,
+                args)
+            properties = Contrast::Agent::Assess::Tracker.properties(ret)
+            properties.copy_from(source, ret)
+
+            node = Contrast::Agent::Assess::Policy::Policy.instance.find_propagator_node('Marshal', :load, false)
+            properties.build_event(node, ret, self, ret, args)
+          rescue StandardError => e
+            logger.error('Unable to determine if a trigger occurred in Marshal.load', e)
+          end
+
+          def instrument_marshal_load
+            @_instrument_marshal_load ||= begin
+              require 'cs__assess_marshal_module/cs__assess_marshal_module'
+              true
+            end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading marshal load patch', e)
+            false
+          end
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extension/assess/regexp.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -47,8 +47,6 @@ module Contrast
             return if scope_for_current_ec.instance_variable_get(:@contrast_scope) > 1
 
             target = info_hash[:back_ref]
-            return unless Contrast::Utils::DuckUtils.trackable?(target)
-
             with_contrast_scope do
               result = info_hash[:result]
               return unless result
@@ -56,8 +54,11 @@ module Contrast
               string = info_hash[:string]
               return unless string
 
-              string.cs__splat_tags(target)
-              target.cs__properties.build_event(
+              properties = Contrast::Agent::Assess::Tracker.properties(target)
+              return unless properties
+
+              properties.splat_from(string, target)
+              properties.build_event(
                   REGEXP_EQUAL_SQUIGGLE_NODE,
                   target,
                   self,
@@ -70,9 +71,9 @@ module Contrast
 
           def instrument_regexp_track
             @_instrument_regexp_track ||= begin
-                                               cs__scoped_require 'cs__assess_regexp/cs__assess_regexp'
-                                               true
-                                             end
+              require 'cs__assess_regexp/cs__assess_regexp'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading regexp track patch', e)
             false

data/lib/contrast/extension/assess/string.rb

@@ -1,15 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/assess_extension'
-
-# This patch installs our extension as early as possible. The alternative is to
-# litter our code with Contrast::Utils::DuckUtils.trackable? checks.
-class String
-  include Contrast::Extension::Assess::AssessExtension
-end
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -40,23 +33,32 @@ module Contrast
           def track_interpolation inputs, result
             return unless AGENT.interpolation_enabled?
             return if in_contrast_scope?
-            return unless inputs.any?(&:cs__tracked?)
+            return unless inputs.any? { |input| Contrast::Agent::Assess::Tracker.tracked?(input) }
 
             with_contrast_scope do
+              properties = Contrast::Agent::Assess::Tracker.properties(result)
+              return unless properties
+
+              parent_events = []
               offset = 0
               inputs.each do |input|
-                result.cs__copy_from(input, offset)
+                properties.copy_from(input, result, offset)
                 offset += input.length
+                parent_event = Contrast::Agent::Assess::Tracker.properties(input)&.event
+                parent_events << parent_event if parent_event
               end
-              result.cs__properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
+              properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
+              properties.event.instance_variable_set(:@_parent_events, parent_events)
             end
+          rescue StandardError => e
+            logger.error('Unable to track interpolation', e)
           end
 
           def instrument_string
             @_instrument_string ||= begin
-                                      cs__scoped_require 'cs__assess_string/cs__assess_string'
-                                      true
-                                    end
+              require 'cs__assess_string/cs__assess_string'
+              true
+            end
           rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false
@@ -65,14 +67,12 @@ module Contrast
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
-                                                    if AGENT.patch_interpolation? && Funchook.available?
-                                                      cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
-                                                    end
-                                                    true
-                                                  rescue StandardError, LoadError => e
-                                                    logger.error('Error loading interpolation patch', e)
-                                                    false
-                                                  end
+                require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26' if AGENT.patch_interpolation? && Funchook.available?
+                true
+              rescue StandardError, LoadError => e
+                logger.error('Error loading interpolation patch', e)
+                false
+              end
             end
             @_instrument_string_interpolation
           end

data/lib/contrast/extension/inventory.rb

@@ -11,11 +11,11 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Inventory
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/inventory/policy/policy'
-      cs__scoped_require 'contrast/agent/patching/policy/patcher'
+      require 'contrast/agent/inventory/policy/trigger_node'
+      require 'contrast/agent/inventory/policy/policy'
+      require 'contrast/agent/patching/policy/patcher'
     end
   end
 end

data/lib/contrast/extension/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/scope'
+require 'contrast/components/scope'
 
 # This is a reasonable place for the Kernel#catch hook to live.
 # No current plans for component re-design, but if we had some kind of

data/lib/contrast/extension/module.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/utils/object_share'
 
 # Some developers override various methods on Module, which can often involve
 # changing expected method parity/behavior which in turn prevents us from being